February 12, 2007 · 2017-10-26 · under Interagency Agreement 2003–IJ–R–029. The National Institute of Justice is a component of the Office of Justice Programs, which also

Se

pt. 2

012

U.S. Department of Justice Office of Justice Programs National Institute of Justice

Special

RepoRt

TestResultsforMobileDeviceAcquisitionTool:

MobilePhoneExaminerPlus(MPE+)4.6.0.2

nij.gov

Office of Justice Programs Innovation • Partnerships • Safer Neighborhoods

www.ojp.usdoj.gov

http:www.ojp.usdoj.gov

U.S. Department of Justice Office of Justice Programs

810 Seventh Street N.W.

Washington, DC 20531

Eric H. Holder, Jr. Attorney General

Mary Lou Leary Acting Assistant Attorney General

John H. Laub Director, National Institute of Justice

This and other publications and products of the National Institute

of Justice can be found at:

National Institute of Justice

www.nij.gov

Office of Justice Programs

Innovation • Partnerships • Safer Neighborhoods

www.ojp.usdoj.gov

http:www.ojp.usdoj.govhttp:www.nij.gov

Sept. 2012

Test Results for Mobile Device Acquisition Tool: Mobile Phone Examiner Plus (MPE+) 4.6.0.2

NCJ 238996

John Laub

Director, National Institute of Justice

This report was prepared for the National Institute of Justice, U.S. Department of Justice, by the Office of Law Enforcement Standards of the National Institute of Standards and Technology under Interagency Agreement 2003–IJ–R–029.

The National Institute of Justice is a component of the Office of Justice Programs, which also includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime.

September 2012

Test Results for Mobile Device Acquisition Tool: Mobile Phone Examiner Plus (MPE+) 4.6.0.2

September 2012 ii Results of MPE+ 4.6.0.2

Contents

Introduction ..................................................................................................................................... 1 How to Read This Report ............................................................................................................... 1

1 Results Summary ...................................................................................................................... 2 2 Test Case Selection ................................................................................................................... 3 3 Results by Test Assertion........................................................................................................ 12

3.1 Device connectivity ......................................................................................................... 38 3.2 Acquisition of subscriber- and equipment-related information ....................................... 38 3.3 Acquisition of Personal Information Management (PIM) data ....................................... 38 3.4 Acquisition of call log data .............................................................................................. 39 3.5 Acquisition of SIM Abbreviated Dialing Numbers (ADN)............................................. 39 3.6 Acquisition of Internal Memory PIM data containing non-ASCII characters................. 39 3.7 Acquisition of SIM PIM data containing non-ASCII characters..................................... 39 3.8 Acquisition of internal memory data elements ................................................................ 39 3.9 Notification of device acquisition disruption................................................................... 39

4 Testing Environment............................................................................................................... 40 4.1 Test computers ................................................................................................................. 40 4.2 Mobile devices ................................................................................................................. 40 4.3 Internal memory data objects........................................................................................... 40 4.4 Subscriber Identity Module data objects.......................................................................... 42

5 Test Results............................................................................................................................. 42 5.1 Test Results Report Key .................................................................................................. 42 5.2 Test Details ...................................................................................................................... 43

5.2.1 SPT-01 (iPhone4 GSM)............................................................................................ 43 5.2.2 SPT-02 (iPhone4 GSM)............................................................................................ 44 5.2.3 SPT-03 (iPhone4 GSM)............................................................................................ 44 5.2.4 SPT-04 (iPhone4 GSM)............................................................................................ 45 5.2.5 SPT-05 (iPhone4 GSM)............................................................................................ 45 5.2.6 SPT-06 (iPhone4 GSM)............................................................................................ 46 5.2.7 SPT-07 (iPhone4 GSM)............................................................................................ 47 5.2.8 SPT-08 (iPhone4 GSM)............................................................................................ 47 5.2.9 SPT-09 (iPhone4 GSM)............................................................................................ 48 5.2.10 SPT-10 (iPhone4 GSM).......................................................................................... 48 5.2.11 SPT-12 (iPhone4 GSM).......................................................................................... 49 5.2.12 SPT-13 (iPhone4 GSM).......................................................................................... 50 5.2.13 SPT-14 (iPhone4 GSM).......................................................................................... 50 5.2.14 SPT-15 (iPhone4 GSM).......................................................................................... 51 5.2.15 SPT-16 (iPhone4 GSM).......................................................................................... 51 5.2.16 SPT-17 (iPhone4 GSM).......................................................................................... 51 5.2.17 SPT-18 (iPhone4 GSM).......................................................................................... 52 5.2.18 SPT-19 (iPhone4 GSM).......................................................................................... 53 5.2.19 SPT-20 (iPhone4 GSM).......................................................................................... 53 5.2.20 SPT-21 (iPhone4 GSM).......................................................................................... 54

September 2012 iii Results of MPE+ 4.6.0.2

5.2.21 SPT-22 (iPhone4 GSM).......................................................................................... 55 5.2.22 SPT-23 (iPhone4 GSM).......................................................................................... 55 5.2.23 SPT-24 (iPhone4 GSM).......................................................................................... 56 5.2.24 SPT-25 (iPhone4 GSM).......................................................................................... 56 5.2.25 SPT-26 (iPhone4 GSM).......................................................................................... 57 5.2.26 SPT-27 (iPhone4 GSM).......................................................................................... 57 5.2.27 SPT-28 (iPhone4 GSM).......................................................................................... 58 5.2.28 SPT-29 (iPhone4 GSM).......................................................................................... 58 5.2.29 SPT-30 (iPhone4 GSM).......................................................................................... 59 5.2.30 SPT-31 (iPhone4 GSM).......................................................................................... 59 5.2.31 SPT-32 (iPhone4 GSM).......................................................................................... 60 5.2.32 SPT-33 (iPhone4 GSM).......................................................................................... 61 5.2.33 SPT-34 (iPhone4 GSM).......................................................................................... 61 5.2.34 SPT-35 (iPhone4 GSM).......................................................................................... 62 5.2.35 SPT-36 (iPhone4 GSM).......................................................................................... 62 5.2.36 SPT-38 (iPhone4 GSM).......................................................................................... 63 5.2.37 SPT-39 (iPhone4 GSM).......................................................................................... 63 5.2.38 SPT-40 (iPhone4 GSM).......................................................................................... 64 5.2.39 SPT-01 (BlackBerry Torch).................................................................................... 64 5.2.40 SPT-02 (BlackBerry Torch).................................................................................... 65 5.2.41 SPT-03 (BlackBerry Torch).................................................................................... 66 5.2.42 SPT-04 (BlackBerry Torch).................................................................................... 66 5.2.43 SPT-05 (BlackBerry Torch).................................................................................... 67 5.2.44 SPT-06 (BlackBerry Torch).................................................................................... 67 5.2.45 SPT-07 (BlackBerry Torch).................................................................................... 68 5.2.46 SPT-08 (BlackBerry Torch).................................................................................... 69 5.2.47 SPT-13 (BlackBerry Torch).................................................................................... 70 5.2.48 SPT-14 (BlackBerry Torch).................................................................................... 70 5.2.49 SPT-15 (BlackBerry Torch).................................................................................... 71 5.2.50 SPT-16 (BlackBerry Torch).................................................................................... 71 5.2.51 SPT-17 (BlackBerry Torch).................................................................................... 72 5.2.52 SPT-18 (BlackBerry Torch).................................................................................... 72 5.2.53 SPT-19 (BlackBerry Torch).................................................................................... 73 5.2.54 SPT-20 (BlackBerry Torch).................................................................................... 74 5.2.55 SPT-21 (BlackBerry Torch).................................................................................... 74 5.2.56 SPT-22 (BlackBerry Torch).................................................................................... 75 5.2.57 SPT-23 (BlackBerry Torch).................................................................................... 75 5.2.58 SPT-24 (BlackBerry Torch).................................................................................... 76 5.2.59 SPT-25 (BlackBerry Torch).................................................................................... 76 5.2.60 SPT-26 (BlackBerry Torch).................................................................................... 77 5.2.61 SPT-27 (BlackBerry Torch).................................................................................... 77 5.2.62 SPT-28 (BlackBerry Torch).................................................................................... 78 5.2.63 SPT-29 (BlackBerry Torch).................................................................................... 78 5.2.64 SPT-30 (BlackBerry Torch).................................................................................... 79 5.2.65 SPT-33 (BlackBerry Torch).................................................................................... 79 5.2.66 SPT-34 (BlackBerry Torch).................................................................................... 80

September 2012 iv Results of MPE+ 4.6.0.2

5.2.67 SPT-35 (BlackBerry Torch).................................................................................... 80 5.2.68 SPT-36 (BlackBerry Torch).................................................................................... 81 5.2.69 SPT-38 (BlackBerry Torch).................................................................................... 81 5.2.70 SPT-39 (BlackBerry Torch).................................................................................... 82 5.2.71 SPT-01 (Nokia 6350).............................................................................................. 82 5.2.72 SPT-02 (Nokia 6350).............................................................................................. 83 5.2.73 SPT-03 (Nokia 6350).............................................................................................. 84 5.2.74 SPT-04 (Nokia 6350).............................................................................................. 84 5.2.75 SPT-05 (Nokia 6350).............................................................................................. 85 5.2.76 SPT-06 (Nokia 6350).............................................................................................. 85 5.2.77 SPT-07 (Nokia 6350).............................................................................................. 86 5.2.78 SPT-08 (Nokia 6350).............................................................................................. 87 5.2.79 SPT-09 (Nokia 6350).............................................................................................. 88 5.2.80 SPT-10 (Nokia 6350).............................................................................................. 88 5.2.81 SPT-13 (Nokia 6350).............................................................................................. 89 5.2.82 SPT-14 (Nokia 6350).............................................................................................. 89 5.2.83 SPT-15 (Nokia 6350).............................................................................................. 90 5.2.84 SPT-16 (Nokia 6350).............................................................................................. 90 5.2.85 SPT-17 (Nokia 6350).............................................................................................. 91 5.2.86 SPT-18 (Nokia 6350).............................................................................................. 91 5.2.87 SPT-19 (Nokia 6350).............................................................................................. 92 5.2.88 SPT-20 (Nokia 6350).............................................................................................. 93 5.2.89 SPT-21 (Nokia 6350).............................................................................................. 93 5.2.90 SPT-22 (Nokia 6350).............................................................................................. 94 5.2.91 SPT-23 (Nokia 6350).............................................................................................. 94 5.2.92 SPT-24 (Nokia 6350).............................................................................................. 95 5.2.93 SPT-25 (Nokia 6350).............................................................................................. 95 5.2.94 SPT-26 (Nokia 6350).............................................................................................. 96 5.2.95 SPT-27 (Nokia 6350).............................................................................................. 96 5.2.96 SPT-28 (Nokia 6350).............................................................................................. 97 5.2.97 SPT-29 (Nokia 6350).............................................................................................. 97 5.2.98 SPT-30 (Nokia 6350).............................................................................................. 98 5.2.99 SPT-33 (Nokia 6350).............................................................................................. 98 5.2.100 SPT-34 (Nokia 6350)............................................................................................ 99 5.2.101 SPT-35 (Nokia 6350)............................................................................................ 99 5.2.102 SPT-36 (Nokia 6350).......................................................................................... 100 5.2.103 SPT-38 (Nokia 6350).......................................................................................... 100 5.2.104 SPT-39 (Nokia 6350).......................................................................................... 101 5.2.105 SPT-01 (Motorola Tundra) ................................................................................. 101 5.2.106 SPT-02 (Motorola Tundra) ................................................................................. 102 5.2.107 SPT-03 (Motorola Tundra) ................................................................................. 103 5.2.108 SPT-04 (Motorola Tundra) ................................................................................. 103 5.2.109 SPT-05 (Motorola Tundra) ................................................................................. 104 5.2.110 SPT-06 (Motorola Tundra) ................................................................................. 104 5.2.111 SPT-10 (Motorola Tundra) ................................................................................. 106 5.2.112 SPT-13 (Motorola Tundra) ................................................................................. 106

September 2012 v Results of MPE+ 4.6.0.2

5.2.113 SPT-14 (Motorola Tundra) ................................................................................. 107 5.2.114 SPT-15 (Motorola Tundra) ................................................................................. 107 5.2.115 SPT-16 (Motorola Tundra) ................................................................................. 108 5.2.116 SPT-17 (Motorola Tundra) ................................................................................. 108 5.2.117 SPT-18 (Motorola Tundra) ................................................................................. 109 5.2.118 SPT-19 (Motorola Tundra) ................................................................................. 109 5.2.119 SPT-20 (Motorola Tundra) ................................................................................. 110 5.2.120 SPT-21 (Motorola Tundra) ................................................................................. 111 5.2.121 SPT-22 (Motorola Tundra) ................................................................................. 111 5.2.122 SPT-23 (Motorola Tundra) ................................................................................. 112 5.2.123 SPT-24 (Motorola Tundra) ................................................................................. 112 5.2.124 SPT-25 (Motorola Tundra) ................................................................................. 113 5.2.125 SPT-26 (Motorola Tundra) ................................................................................. 113 5.2.126 SPT-27 (Motorola Tundra) ................................................................................. 114 5.2.127 SPT-28 (Motorola Tundra) ................................................................................. 114 5.2.128 SPT-29 (Motorola Tundra) ................................................................................. 115 5.2.129 SPT-30 (Motorola Tundra) ................................................................................. 115 5.2.130 SPT-33 (Motorola Tundra) ................................................................................. 116 5.2.131 SPT-34 (Motorola Tundra) ................................................................................. 116 5.2.132 SPT-35 (Motorola Tundra) ................................................................................. 117 5.2.133 SPT-36 (Motorola Tundra) ................................................................................. 117 5.2.134 SPT-38 (Motorola Tundra) ................................................................................. 118 5.2.135 SPT-39 (Motorola Tundra) ................................................................................. 118 5.2.136 SPT-01 (HTC Thunderbolt)................................................................................ 119 5.2.137 SPT-02 (HTC Thunderbolt)................................................................................ 120 5.2.138 SPT-03 (HTC Thunderbolt)................................................................................ 120 5.2.139 SPT-04 (HTC Thunderbolt)................................................................................ 121 5.2.140 SPT-05 (HTC Thunderbolt)................................................................................ 121 5.2.141 SPT-06 (HTC Thunderbolt)................................................................................ 122 5.2.142 SPT-07 (HTC Thunderbolt)................................................................................ 123 5.2.143 SPT-08 (HTC Thunderbolt)................................................................................ 123 5.2.144 SPT-10 (HTC Thunderbolt)................................................................................ 124 5.2.145 SPT-11 (HTC Thunderbolt)................................................................................ 125 5.2.146 SPT-13 (HTC Thunderbolt)................................................................................ 125 5.2.147 SPT-24 (HTC Thunderbolt)................................................................................ 126 5.2.148 SPT-25 (HTC Thunderbolt)................................................................................ 126 5.2.149 SPT-29 (HTC Thunderbolt)................................................................................ 127 5.2.150 SPT-33 (HTC Thunderbolt)................................................................................ 127 5.2.151 SPT-38 (HTC Thunderbolt)................................................................................ 128

September 2012 vi Results of MPE+ 4.6.0.2

Introduction The Computer Forensics Tool Testing (CFTT) program is a joint project of the National Institute of Justice (NIJ), the Department of Homeland Security Science and Technology Directorate (DHS S&T), and the National Institute of Standards and Technology (NIST) Law Enforcement Standards Office (OLES) and Information Technology Laboratory (ITL). CFTT is supported by other organizations, including the Federal Bureau of Investigation, the U.S. Department of Defense Cyber Crime Center, the U.S. Internal Revenue Service Criminal Investigation Division Electronic Crimes Program, and the U.S. Department of Homeland Security’s Bureau of Immigration and Customs Enforcement, U.S. Customs and Border Protection and U.S. Secret Service, the Naval Postgraduate School, the National White Collar Crime Center, the U.S. Commodity Futures Trading Commission, the U.S. Postal Service and the Securities and Exchange Commission. The objective of the CFTT program is to provide measurable assurance to practitioners, researchers and other applicable users that the tools used in computer forensics investigations provide accurate results. Accomplishing this requires the development of specifications and test methods for computer forensics tools and subsequent testing of specific tools against those specifications.

Test results provide the information necessary for developers to improve tools, users to make informed choices, and the legal community and others to understand the tools’ capabilities. The CFTT approach to testing computer forensic tools is based on well-recognized methodologies for conformance and quality testing. The specifications and test methods posted on the CFTT Web site (http://www.cftt.nist.gov/) for review and comment by the computer forensics community.

This document reports the results from testing Mobile Phone Examiner Plus, version 4.6.0.2, against the Smart Phone Tool Test Assertions and Test Plan, available at the CFTT Web site (http://www.cftt.nist.gov/mobile_devices.htm).

Test results from other tools and the CFTT tool methodology can be found on NIJ’s CFTT Web page, http://www.ojp.usdoj.gov/nij/topics/technology/electroniccrime/cftt.htm.

How to Read This Report This report is divided into five sections. The first section is a summary of the results from the test runs. This section is sufficient for most readers to assess the suitability of the tool for its intended use. The remaining sections of the report describe how the tests were conducted, discuss any anomalies that were encountered and provide documentation of test case run details that support the report summary. Section 2 gives justification for the selection of test cases from the set of possible cases defined in the test plan for Smart phone forensic tools. The test cases are selected, in general, based on features offered by the tool. Section 3 describes in more depth any anomalies summarized in the first section. Section 4 lists hardware and software used to run the test cases. Section 5 contains a

http://www.cftt.nist.gov/http://www.cftt.nist.gov/mobile_devices.htmhttp://www.ojp.usdoj.gov/nij/topics/technology/electronic-crime/cftt.htmhttp://www.ojp.usdoj.gov/nij/topics/technology/electronic-crime/cftt.htm

description of each test case run. The description of each test run lists all test assertions used in the test case, the expected result and the actual result. Please refer to the vendor’s owner manual for guidance on using the tool.

Test Results for Mobile Device Data Acquisition Tool

Tool Tested: Mobile Phone Examiner Plus

Version: 4.6.0.2

Run Environment: Microsoft Windows XP v5.1.2600

Supplier: AccessData

Address: 384 South 400 West Suite 200, Lindon, UT 84042

Tel: 800-574-5199Fax: 801-765-4370Web: http://www.accessdata.com

1 Results Summary Mobile Phone Examiner Plus is designed for logical and physical acquisitions, data analysis and report management from mobile phones, Smart phones and Subscriber Identity Modules (SIMs).

The tool was tested for its ability to acquire active and deleted data from the internal memory of mobile devices and SIMs. Except for the following anomalies, the tool acquired all supported data objects completely and accurately for all six mobile devices tested.

Device connectivity: Connectivity to the mobile device was inconsistent, 1 out of 20 attempts were

successful. (HTC Thunderbolt)Subscriber- and equipment-related information: Subscriber-related information was not reported. (iPhone4 GSM, Nokia 6350) Equipment-related information was not reported. (iPhone4 GSM, HTC

Thunderbolt) Personal Information Management (PIM) data: Graphics files associated with address book entries were not reported.

(BlackBerry Torch) Calendar entries were not acquired. (BlackBerry Torch) One out of seven address book entries were reported. (Nokia 6350) Address book entries with fields for a first, middle and last name were reported

incorrectly. The middle- and last-name fields were not reported. (MotorolaTundra)

September 2012 2 of 128 Results of MPE+ 4.6.0.2

http://www.accessdata.com/

Call logs: Acquisition of call log data ended in errors. (BlackBerry Torch)

Abbreviated Dialing Numbers (ADN): Acquisition of ADN containing the special character ‘@’ were not acquired.

(SIM)Non-ASCII characters: Text messages containing the non-ASCII character ‘é’ were reported as ‘|’.

(BlackBerry Torch) Address book entries containing non-ASCII characters were reported as ‘?’.

(Motorola Tundra) Acquisition of ADN containing the non-ASCII character ‘é’ ended in errors.

(SIM)Acquisition of internal memory data elements: Acquisition of the File System ended in errors. (Motorola Tundra)

Device acquisition disruption: When connectivity was interrupted, the tool failed to notify the user that the

acquisition had been disrupted. (Motorola Tundra)

Refer to sections 3.1–3.9 for additional details.

2 Test Case Selection Test cases used to test mobile device acquisition tools are defined in Smart Phone Tool Test Assertions and Test Plan Version 1.0. To test a tool, test cases are selected from the Test Plan document based on the features offered by the tool. Not all test cases or test assertions are appropriate for all tools. There is a core set of bases cases that are executed for every tool tested. Tool features guide the selection of additional test cases. If a given tool implements a given feature, then the test cases linked to that feature are run. Tables (1a-1e) list the test cases available in Mobile Phone Examiner Plus. Tables (2a-2e) list the test cases not available in Mobile Phone Examiner Plus.

Table 1a: Selected Test Cases (iPhone4 GSM)

Supported Optional Feature Cases Selected for Execution Base Cases SPT-01, SPT-02, SPT-03,

SPT-04, SPT-05, SPT-06, SPT-07, SPT-08, SPT-09, SPT-10, SPT-12, SPT-13

Acquire SIM memory over supported interfaces (e.g., PC/SC reader).

SPT-14

Attempt acquisition of a nonsupported SIM. SPT-15 Begin SIM acquisition and interrupt connectivity by interface disengagement.

SPT-16

Acquire SIM memory and review reported subscriber- and equipment-related information (i.e., SPN, ICCID, IMSI, MSISDN).

SPT-17


Supported Optional Feature Cases Selected for Execution Acquire SIM memory and review reported Abbreviated Dialing Numbers (ADN).

SPT-18

Acquire SIM memory and review reported Last Numbers Dialed (LND).

SPT-19

Acquire SIM memory and review reported text messages (SMS, EMS).

SPT-20

Acquire SIM memory and review recoverable deleted text messages (SMS, EMS).

SPT-21

Acquire SIM memory and review reported location-related data (i.e., LOCI, GPRSLOCI).

SPT-22

Acquire SIM memory by selecting a combination of supported data elements.

SPT-23

Acquire mobile device internal memory and review reported data via supported generated report formats.

SPT-24

Acquire mobile device internal memory and review reported data via the preview pane.

SPT-25

Acquire SIM memory and review reported data via supported generated report formats.

SPT-26

Acquire SIM memory and review reported data via the preview pane.

SPT-27

Attempt acquisition of a password-protected SIM. SPT-28 After a successful mobile device internal memory, alter the case file via third-party means and attempt to reopen the case.

SPT-29

After a successful SIM acquisition, alter the case file via third-party means and attempt to reopen the case.

SPT-30

Perform a physical acquisition and review data output for readability.

SPT-31

Perform a physical acquisition and review reports for recoverable deleted data.

SPT-32

Acquire mobile device internal memory and review data containing non-ASCII characters.

SPT-33

Acquire SIM memory and review data containing non-ASCII characters.

SPT-34

Begin acquisition on a PIN-protected SIM to determine if the tool provides an accurate count of the remaining number of PIN attempts and if the PIN attempts are decremented when entering an incorrect value.

SPT-35

Begin acquisition on a SIM whose PIN attempts have been exhausted to determine if the tool provides an accurate count of the remaining number of PUK attempts and if the PUK attempts are decremented when entering an incorrect value.

SPT-36

Acquire mobile device internal memory and review hash values for vendor supported data objects.

SPT-38


Supported Optional Feature Cases Selected for Execution Acquire SIM memory and review hash values for vendor supported data objects.

SPT-39

Acquire mobile device internal memory and review data containing GPS longitude and latitude coordinates.

SPT-40

Table 2a: Omitted Test Cases (iPhone4 GSM)

Unsupported Optional Feature Cases omitted not executed

Acquire mobile device internal memory and review application-related data (i.e., word documents, spreadsheet, presentation documents).

SPT-11

Perform a stand-alone mobile device internal memory acquisition and review the status flags for text messages present on the SIM.

SPT-37

Table 1b: Selected Test Cases (BlackBerry Torch)

Supported Optional Feature Cases Selected for Execution

Base Cases SPT-01, SPT-02, SPT03, SPT-04, SPT-05, SPT-06, SPT-07, SPT08, SPT-13


SPT-14


SPT-16


SPT-17

Acquire SIM memory and review reported Abbreviated Dialing Numbers (ADN).

SPT-18


SPT-19


SPT-20


SPT-21


SPT-22


SPT-23


SPT-24


SPT-25


Supported Optional Feature Cases Selected for Execution


SPT-26


SPT-27


SPT-29


SPT-30


SPT-33


SPT-34

Begin acquisition on a PIN-protectedPIN-protected SIM to determine if the tool provides an accurate count of the remaining number of PIN attempts and if the PIN attempts are decremented when entering an incorrect value.

SPT-35


SPT-36


SPT-38

Acquire SIM memory and review hash values for vendor supported data objects.

SPT-39

Table 2b: Omitted Test Cases (BlackBerry Torch)


Acquire mobile device internal memory and review reported MMS multimedia-related data (i.e., text, audio, graphics, video).

SPT-09

Acquire mobile device internal memory and review reported standalone multi-media data (i.e., audio, graphics, video).

SPT-10


SPT-11

Acquire mobile device internal memory and review Internet-related data (i.e., bookmarks, visited sites).

SPT-12

Perform a physical acquisition and review data output for readability. SPT-31 Perform a physical acquisition and review reports for recoverable deleted data.

SPT-32


SPT-37

Acquire mobile device internal memory and review data containing SPT-40




SPT-09

Acquire mobile device internal memory and review reported standalone multi-media data (i.e., audio, graphics, video).

SPT-10


SPT-11


SPT-12


SPT-32

GPS longitude and latitude coordinates.

Table 1c: Selected Test Cases (Nokia 6350)

Supported Optional Feature Cases Selected for Execution Base Cases SPT-01, SPT-02, SPT-03,

SPT-04, SPT-05, SPT-06, SPT-07, SPT-08, SPT-09, SPT-10, SPT-13


SPT-14


SPT-16


SPT-17


SPT-18


SPT-19


SPT-20


SPT-21


SPT-22


SPT-23


SPT-24


SPT-25


Supported Optional Feature Cases Selected for Execution Acquire SIM memory and review reported data via supported generated report formats.

SPT-26


SPT-27


SPT-29


SPT-30


SPT-33


SPT-34


SPT-35


SPT-36


SPT-38


SPT-39

Table 2c: Omitted Test Cases (Nokia 6350)



SPT-11


SPT-12


SPT-32


SPT-37


SPT-40

Table 1d: Selected Test Cases (Motorola Tundra)

Supported Optional Feature Cases Selected for


Execution Base Cases SPT-01, SPT-02,

SPT-03, SPT-04, SPT-05, SPT-06, SPT-10, SPT-13


SPT-14


SPT-16


SPT-17


SPT-18


SPT-19


SPT-20


SPT-21


SPT-22


SPT-23


SPT-24


SPT-25


SPT-26


SPT-27


SPT-29


SPT-30


SPT-33


SPT-34


SPT-35



SPT-36


SPT-38


SPT-39

Table 2d: Omitted Test Cases (Motorola Tundra)


Acquire mobile device internal memory and review reported call logs. SPT-07 Acquire mobile device internal memory and review reported text messages.

SPT-08


SPT-09


SPT-11


SPT-12


SPT-32

Perform a stand alone mobile device internal memory acquisition and review the status flags for text messages present on the SIM.

SPT-37


SPT-40

Table 1e: Selected Test Cases (HTC Thunderbolt)

Supported Optional Feature Cases Selected for Execution Base Cases SPT-01, SPT-02, SPT-03, SPT-04,

SPT-05, SPT-06, SPT-07, SPT-08, SPT-10, SPT-11, SPT-13


SPT-24


SPT-25

After a successful mobile device internal memory, alter the case file via third-party means and attempt to reopen the case.

SPT-29


SPT-33


SPT-38


Table 2e: Omitted Test Cases (HTC Thunderbolt)

Unsupported Optional Feature Cases omitted - not executed


SPT-09


SPT-12

Acquire SIM memory over supported interfaces (e.g., PC/SC reader). SPT-14 Attempt acquisition of a nonsupported SIM. SPT-15 Begin SIM acquisition and interrupt connectivity by interface disengagement.

SPT-16


SPT-17


SPT-18

Acquire SIM memory and review reported Last Numbers Dialed (LND). SPT-19 Acquire SIM memory and review reported text messages (SMS, EMS). SPT-20 Acquire SIM memory and review recoverable deleted text messages (SMS, EMS).

SPT-21


SPT-22


SPT-23


SPT-26

Acquire SIM memory and review reported data via the preview pane. SPT-27 Attempt acquisition of a password-protected SIM. SPT-28 After a successful SIM acquisition, alter the case file via third-party means and attempt to reopen the case.

SPT-30


SPT-32

Acquire SIM memory and review data containing non-ASCII characters. SPT-34 Begin acquisition on a PIN-protected SIM to determine if the tool provides an accurate count of the remaining number of PIN attempts and if the PIN attempts are decremented when entering an incorrect value.

SPT-35


SPT-36



SPT-37


SPT-39


SPT-40

3 Results by Test Assertion A test assertion is a verifiable statement about a single condition after an action is performed by the tool under test. A test case usually checks a group of assertions after the action of a single execution of the tool under test. Test assertions are defined and linked to test cases in Smart Phone Tool Test Assertions and Test Plan Version 1.0.

Tables 3a – 3e summarize the test results by assertion. The column labeled Assertions Tested describes the text of each assertion. The column labeled Tests gives the number of test cases that use the given assertion. The column labeled Anomaly gives the section number in this report where any obverved anomalies are discussed.

Table 3a: Assertions Tested: (iPhone4 GSM)

Assertions Tested Tests Anomaly SPT-CA-01 If a cellular forensic tool provides support for connectivity of the target device, then the tool shall successfully recognize the target device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

1

SPT-CA-02 If a cellular forensic tool attempts to connect to a nonsupported device, then the tool shall notify the user that the device is not supported.

1

SPT-CA-03 If connectivity between the mobile device and cellular forensic tool is disrupted, then the tool shall notify the user that connectivity has been disrupted.

1

SPT-CA-04 If a cellular forensic tool completes acquisition of the target device without error, then the tool shall have the ability to present acquired data objects in a useable format via either a preview pane or generated report.

2

SPT-CA-05 If a cellular forensic tool completes acquisition of the target device without error, then subscriber-related information shall be presented in a useable format.

1 3.2

SPT-CA-06 If a cellular forensic tool completes acquisition of the target device without error, then equipment-related information shall be presented in a useable format.

1 3.2

SPT-CA-07 If a cellular forensic tool completes acquisition of the target device without error, then address book entries shall be presented in a useable format.

1

SPT-CA-08 If a cellular forensic tool completes acquisition of the target device without error, then maximum length address book entries shall 1


Assertions Tested Tests Anomaly be presented in a useable format. SPT-CA-09 If a cellular forensic tool completes acquisition of the target device without error, then address book entries containing special characters shall be presented in a useable format.

1

SPT-CA-10 If a cellular forensic tool completes acquisition of the target device without error, then address book entries containing blank names shall be presented in a useable format.

1

SPT-CA-11 If a cellular forensic tool completes acquisition of the target device without error, then email addresses associated with address book entries shall be presented in a useable format.

1

SPT-CA-12 If a cellular forensic tool completes acquisition of the target device without error, then graphics associated with address book entries shall be presented in a useable format.

1

SPT-CA-13 If a cellular forensic tool completes acquisition of the target device without error, then datebook, calendar, note entries shall be presented in a useable format.

1

SPT-CA-14 If a cellular forensic tool completes acquisition of the target device without error, then maximum length datebook, calendar, note entries shall be presented in a useable format.

1

SPT-CA-15 If a cellular forensic tool completes acquisition of the target device without error, then call logs (incoming/outgoing/missed) shall be presented in a useable format.

1

SPT-CA-16 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding date/time stamps and the duration of the call for call logs shall be presented in a useable format.

1

SPT-CA-17 If a cellular forensic tool completes acquisition of the target device without error, then ASCII text messages (i.e., SMS, EMS) shall be presented in a useable format.

1

SPT-CA-18 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding date/time stamps for text messages shall be presented in a useable format.

1

SPT-CA-19 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding status (i.e., read, unread) for text messages shall be presented in a useable format.

1

SPT-CA-20 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding sender/recipient phone numbers for text messages shall be presented in a useable format.

1

SPT-CA-21 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated audio shall be presented in a useable format.

1

SPT-CA-22 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated graphic files shall be presented in a useable format.

1

SPT-CA-23 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated video shall be 1


Assertions Tested Tests Anomaly presented in a useable format. SPT-CA-24 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone audio files shall be presented in a useable format via either an internal application or suggested third-party application.

1

SPT-CA-25 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone graphic files shall be presented in a useable format via either an internal application or suggested third-party application.

1

SPT-CA-26 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone video files shall be presented in a useable format via either an internal application or suggested third-party application.

1

SPT-CA-28 If a cellular forensic tool completes acquisition of the target device without error, then Internet-related data (i.e., bookmarks, visited sites) cached to the device shall be acquired and presented in a useable format.

1

SPT-CA-29 If a cellular forensic tool provides the user with an “Acquire All” device data objects acquisition option, then the tool shall complete the acquisition of all data objects without error.

2

SPT-CA-30 If a cellular forensic tool provides the user with a “Select All” individual device data objects, then the tool shall complete the acquisition of all individually selected data objects without error.

2

SPT-CA-31 If a cellular forensic tool provides the user with the ability to “Select Individual” device data objects for acquisition, then the tool shall acquire each exclusive data object without error.

2

SPT-CA-32 If a cellular forensic tool completes two consecutive logical acquisitions of the target device without error, then the payload (data objects) on the mobile device shall remain consistent.

1

SPT-AO-01 If a cellular forensic tool provides support for connectivity of the target SIM, then the tool shall successfully recognize the target SIM via all tool-supported interfaces (e.g., PC/SC reader, proprietary reader, Smart phone itself).

2

SPT-AO-02 If a cellular forensic tool attempts to connect to a nonsupported SIM, then the tool shall notify the user that the SIM is not supported.

1

SPT-AO-03 If a cellular forensic tool loses connectivity with the SIM reader, then the tool shall notify the user that connectivity has been disrupted.

1

SPT-AO-04 If a cellular forensic tool completes acquisition of the target SIM without error, then the SPN shall be presented in a useable format. 1

SPT-AO-05 If a cellular forensic tool completes acquisition of the target SIM without error, then the ICCID shall be presented in a useable format.

1

SPT-AO-06 If a cellular forensic tool completes acquisition of the target 1


Assertions Tested Tests Anomaly SIM without error, then the IMSI shall be presented in a useable format. SPT-AO-07 If a cellular forensic tool completes acquisition of the target SIM without error, then the MSISDN shall be presented in a useable format.

1

SPT-AO-08 If a cellular forensic tool completes acquisition of the target SIM without error, then ASCII Abbreviated Dialing Numbers (ADN) shall be presented in a useable format.

1

SPT-AO-09 If a cellular forensic tool completes acquisition of the target SIM without error, then maximum length ADN shall be presented in a useable format.

1

SPT-AO-10 If a cellular forensic tool completes acquisition of the SIM without error, then ADN containing special characters shall be presented in a useable format.

1 3.5

SPT-AO-11 If a cellular forensic tool completes acquisition of the SIM without error, then ADN containing blank names shall be presented in a useable format.

1

SPT-AO-12 If a cellular forensic tool completes acquisition of the target SIM without error, then Last Numbers Dialed (LND) shall be presented in a useable format.

1

SPT-AO-13 If a cellular forensic tool completes acquisition of the target SIM without error, then the corresponding date/time stamps for LNDs shall be presented in a useable format.

1

SPT-AO-14 If a cellular forensic tool completes acquisition of the target SIM without error, then ASCII SMS text messages shall be presented in a useable format.

1

SPT-AO-15 If a cellular forensic tool completes acquisition of the target SIM without error, then ASCII EMS text messages shall be presented in a useable format.

1

SPT-AO-16 If a cellular forensic tool completes acquisition of the target SIM without error, then the corresponding date/time stamps for all text messages shall be presented in a useable format.

1

SPT-AO-17 If a cellular forensic tool completes acquisition of the target SIM without error, then the corresponding status (i.e., read, unread) for text messages shall be presented in a useable format.

1

SPT-AO-18 If a cellular forensic tool completes acquisition of the target SIM without error, then the corresponding sender/recipient phone numbers for text messages shall be presented in a useable format.

1

SPT-AO-19 If the cellular forensic tool completes acquisition of the target SIM without error, then deleted text messages that have not been overwritten shall be presented in a useable format.

1

SPT-AO-20 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., LOCI) shall be presented in a useable format.

1

SPT-AO-21 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., GRPSLOCI) shall be 1


Assertions Tested Tests Anomaly presented in a useable format. SPT-AO-22 If a cellular forensic tool provides the user with an “Acquire All” SIM data objects acquisition option, then the tool shall complete the acquisition of all data objects without error.

1

SPT-AO-23 If a cellular forensic tool provides the user with an “Select All” individual SIM data objects, then the tool shall complete the acquisition of all individually selected data objects without error.

1

SPT-AO-24 If a cellular forensic tool provides the user with the ability to “Select Individual” SIM data objects for acquisition, then the tool shall acquire each exclusive data object without error.

1

SPT-AO-25 If a cellular forensic tool completes acquisition of the SIM without error, then the tool shall present the acquired data in a useable format via supported generated report formats.

2

SPT-AO-26 If a cellular forensic tool completes acquisition of the SIM without error, then the tool shall present the acquired data in a useable format in a preview-pane view.

2

SPT-AO-27 If the case file or individual data objects are modified via third-party means, then the tool shall provide protection mechanisms disallowing or reporting data modification.

2

SPT-AO-28 If the SIM is password-protected, then the cellular forensic tool shall provide the examiner with the opportunity to input the PIN before acquisition.

1

SPT-AO-29 If a cellular forensic tool provides the examiner with the remaining number of authentication attempts, then the application should provide an accurate count of the remaining PIN attempts.

1

SPT-AO-30 If a cellular forensic tool provides the examiner with the remaining number of PUK attempts, then the application should provide an accurate count of the remaining PUK attempts.

1

SPT-AO-31 If the cellular forensic tool supports a physical acquisition of the target device, then the tool shall complete the acquisition without error.

1

SPT-AO-32 If the cellular forensic tool supports the interpretation of address book entries present on the target device, then the tool shall report recoverable active and deleted data or address book data remnants in a useable format.

1

SPT-AO-33 If the cellular forensic tool supports the interpretation of calendar, tasks, or notes present on the target device, then the tool shall report recoverable active and deleted calendar, tasks, or note data remnants in a useable format.

1

SPT-AO-34 If the cellular forensic tool supports the interpretation of call logs present on the target device, then the tool shall report recoverable active and deleted call or call log data remnants in a useable format.

1

SPT-AO-35 If the cellular forensic tool supports the interpretation of SMS messages present on the target device, then the tool shall report 1


Assertions Tested Tests Anomaly recoverable active and deleted SMS messages or SMS message data remnants in a useable format. SPT-AO-36 If the cellular forensic tool supports the interpretation of EMS messages present on the target device, then the tool shall report recoverable active and deleted EMS messages or EMS message data remnants in a useable format.

1

SPT-AO-37 If the cellular forensic tool supports the interpretation of audio files present on the target device, then the tool shall report recoverable active and deleted audio data or audio file data remnants in a useable format.

1

SPT-AO-38 If the cellular forensic tool supports the interpretation of graphic files present on the target device, then the tool shall report recoverable active and deleted graphic file data or graphic file data remnants in a useable format.

1

SPT-AO-39 If the cellular forensic tool supports the interpretation of video files present on the target device, then the tool shall report recoverable active and deleted video file data or video file data remnants in a useable format.

1

SPT-AO-40 If the cellular forensic tool supports display of non-ASCII characters, then the application should present ADN in their native format.

2 3.7

SPT-AO-41 If the cellular forensic tool supports proper display of non-ASCII characters, then the application should present text messages in their native format.

2

SPT-AO-43 If the cellular forensic tool supports hashing for individual data objects, then the tool shall present the user with a hash value for each supported data object.

2

SPT-AO-44 If the cellular forensic tool supports acquisition of GPS data, then the tool shall present the user with the longitude and latitude coordinates for all GPS-related data in a useable format.

1

Table 3b: Assertions Tested: (BlackBerry Torch) Assertions Tested Tests Anomaly SPT-CA-01 If a cellular forensic tool provides support for connectivity of the target device, then the tool shall successfully recognize the target device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

1


1


1

SPT-CA-04 If a cellular forensic tool completes acquisition of the target device without error, then the tool shall have the ability to present acquired data objects in a useable format via either a preview pane or

2


Assertions Tested Tests Anomaly generated report. SPT-CA-05 If a cellular forensic tool completes acquisition of the target device without error, then subscriber-related information shall be presented in a useable format.

1

SPT-CA-06 If a cellular forensic tool completes acquisition of the target device without error, then equipment-related information shall be presented in a useable format.

1


1

SPT-CA-08 If a cellular forensic tool completes acquisition of the target device without error, then maximum length address book entries shall be presented in a useable format.

1

SPT-CA-09 If a cellular forensic tool completes acquisition of the target device without error, then address book entries containing special characters shall be presented in a useable format.

1


1


1


1 3.3


1 3.3


1 3.3


1 3.4


1 3.4


1


1

SPT-CA-19 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding status (i.e., read, unread) 1


Assertions Tested Tests Anomaly for text messages shall be presented in a useable format. SPT-CA-20 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding sender/recipient phone numbers for text messages shall be presented in a useable format.

1


2


2


2


1


2


1


1

SPT-AO-04 If a cellular forensic tool completes acquisition of the target SIM without error, then the SPN shall be presented in a useable format. 1

SPT-AO-05 If a cellular forensic tool completes acquisition of the target SIM without error, then the ICCID shall be presented in a useable format.

1

SPT-AO-06 If a cellular forensic tool completes acquisition of the target SIM without error, then the IMSI shall be presented in a useable format. 1

SPT-AO-07 If a cellular forensic tool completes acquisition of the target SIM without error, then the MSISDN shall be presented in a useable format.

1


1


1


1 3.5


Assertions Tested Tests Anomaly SPT-AO-11 If a cellular forensic tool completes acquisition of the SIM without error, then ADN containing blank names shall be presented in a useable format.

1


1


1


1


1


1


1


1


1

SPT-AO-20 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., LOCI) shall be presented in a useable format.

1

SPT-AO-21 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., GRPSLOCI) shall be presented in a useable format.

1

SPT-AO-22 If a cellular forensic tool provides the user with an “Acquire All” SIM data objects acquisition option, then the tool shall complete the acquisition of all data objects without error.

1

SPT-AO-23 If a cellular forensic tool provides the user with an “Select All” individual SIM data objects, then the tool shall complete the acquisition of all individually selected data objects without error.

1

SPT-AO-24 If a cellular forensic tool provides the user with the ability to “Select Individual” SIM data objects for acquisition, then the tool shall acquire each exclusive data object without error.

1

SPT-AO-25 If a cellular forensic tool completes acquisition of the SIM without error, then the tool shall present the acquired data in a useable format via supported generated report formats.

2


Assertions Tested Tests Anomaly SPT-AO-26 If a cellular forensic tool completes acquisition of the SIM without error, then the tool shall present the acquired data in a useable format in a preview-pane view.

2


2


1

SPT-AO-28 If the SIM is password-protected, then the cellular forensic tool shall provide the examiner with the opportunity to input the PIN before acquisition.

1

SPT-AO-29 If a cellular forensic tool provides the examiner with the remaining number of authentication attempts, then the application should provide an accurate count of the remaining PIN attempts.

1

SPT-AO-30 If a cellular forensic tool provides the examiner with the remaining number of PUK attempts, then the application should provide an accurate count of the remaining PUK attempts.

1

SPT-AO-40 If the cellular forensic tool supports display of non-ASCII characters, then the application should present ADN in their native format.

2 3.7

SPT-AO-41 If the cellular forensic tool supports proper display of non-ASCII characters, then the application should present text messages in their native format.

2 3.6

SPT-AO-43 If the cellular forensic tool supports hashing for individual data objects, then the tool shall present the user with a hash value for each supported data object.

2

Table 3c: Assertions Tested: (Nokia 6350) Assertions Tested Tests Anomaly SPT-CA-01 If a cellular forensic tool provides support for connectivity of the target device, then the tool shall successfully recognize the target device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

1


1


1

SPT-CA-04 If a cellular forensic tool completes acquisition of the target device without error, then the tool shall have the ability to present acquired data objects in a useable format via either a preview pane or generated report.

2

SPT-CA-05 If a cellular forensic tool completes acquisition of the target device without error, then subscriber-related information shall be 1 3.2


Assertions Tested Tests Anomaly presented in a useable format. SPT-CA-06 If a cellular forensic tool completes acquisition of the target device without error, then equipment-related information shall be presented in a useable format.

1


1

SPT-CA-08 If a cellular forensic tool completes acquisition of the target device without error, then maximum length address book entries shall be presented in a useable format.

1 3.3

SPT-CA-09 If a cellular forensic tool completes acquisition of the target device without error, then address book entries containing special characters shall be presented in a useable format.

1 3.3


1 3.3


1


1


1


1


1


1


1


1

SPT-CA-19 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding status (i.e., read, unread) for text messages shall be presented in a useable format.

1

SPT-CA-20 If a cellular forensic tool completes acquisition of the target device without error, then the corresponding sender/recipient phone 1


Assertions Tested Tests Anomaly numbers for text messages shall be presented in a useable format. SPT-CA-21 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated audio shall be presented in a useable format.

1

SPT-CA-22 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated graphic files shall be presented in a useable format.

1

SPT-CA-23 If a cellular forensic tool completes acquisition of the target device without error, then MMS messages and associated video shall be presented in a useable format.

1

SPT-CA-24 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone audio files shall be presented in a useable format via either an internal application or suggested third-party application.

1

SPT-CA-25 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone graphic files shall be presented in a useable format via either an internal application or suggested third-party application.

1

SPT-CA-26 If a cellular forensic tool completes acquisition of the target device without error, then stand-alone video files shall be presented in a useable format via either an internal application or suggested third-party application.

1


2


2


2


1


2


1


1

SPT-AO-04 If a cellular forensic tool completes acquisition of the target 1


Assertions Tested Tests Anomaly SIM without error, then the SPN shall be presented in a useable format. SPT-AO-05 If a cellular forensic tool completes acquisition of the target SIM without error, then the ICCID shall be presented in a useable format.

1

SPT-AO-06 If a cellular forensic tool completes acquisition of the target SIM without error, then the IMSI shall be presented in a useable format. 1

SPT-AO-07 If a cellular forensic tool completes acquisition of the target SIM without error, then the MSISDN shall be presented in a useable format.

1


1


1


1 3.5

SPT-AO-11 If a cellular forensic tool completes acquisition of the SIM without error, then ADN containing blank names shall be presented in a useable format.

1


1


1


1


1


1


1


1


1


Assertions Tested Tests Anomaly SPT-AO-20 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., LOCI) shall be presented in a useable format.

1

SPT-AO-21 If a cellular forensic tool completes acquisition of the target SIM without error, then location-related data (i.e., GRPSLOCI) shall be presented in a useable format.

1

SPT-AO-22 If a cellular forensic

Documents

February 12, 2007 · 2017-10-26 · under Interagency Agreement 2003–IJ–R–029. The National Institute of Justice is a component of the Office of Justice Programs, which also